Project:
| View Issue Details[ Jump to Notes ] | [ Issue History ] [ Print ] | |||||||
| ID | ||||||||
| 0024556 | ||||||||
| Type | Category | Severity | Reproducibility | Date Submitted | Last Update | |||
| defect | [Openbravo ERP] A. Platform | major | have not tried | 2013-08-21 17:46 | 2013-08-22 18:17 | |||
| Reporter | shuehner | View Status | public | |||||
| Assigned To | shuehner | |||||||
| Priority | immediate | Resolution | fixed | Fixed in Version | 3.0MP27 | |||
| Status | closed | Fix in branch | Fixed in SCM revision | b975d72dec38 | ||||
| Projection | none | ETA | none | Target Version | 3.0MP27 | |||
| OS | Any | Database | Any | Java version | ||||
| OS Version | Database version | Ant version | ||||||
| Product Version | SCM revision | |||||||
| Review Assigned To | AugustoMauch | |||||||
| Web browser | ||||||||
| Modules | Core | |||||||
| Regression level | ||||||||
| Regression date | ||||||||
| Regression introduced in release | ||||||||
| Regression introduced by commit | ||||||||
| Triggers an Emergency Pack | No | |||||||
| Summary | 0024556: Reconfigure xml-parser used by /ws/dal to disallow referencing external entities | |||||||
| Description | The xerces xml parser used by Openbravo by default allowed referencing external entities defined in the xml-data being parsed by it. As data processed by the code behind /ws/dal is untrusted by default as it is coming from external sources those features must be disabled. | |||||||
| Steps To Reproduce | send an xml document using feature as described above to the xml-webservices. | |||||||
| Proposed Solution | Reconfigure xml-parser to disallow those features in the /ws/dal endpoint. | |||||||
| Tags | No tags attached. | |||||||
| Attached Files | ||||||||
 Relationships [ Relation Graph ]
[ Dependency Graph ]
|
|||||||||||||||
|
|||||||||||||||
 Relationships |
|
Notes |
|
|
(0060714) hgbot (developer) 2013-08-21 18:11 |
Repository: erp/devel/pi Changeset: b975d72dec38be6c7a9ca8444a98db8924647c1a Author: Stefan Hühner <stefan.huehner <at> openbravo.com> Date: Wed Aug 21 17:53:18 2013 +0200 URL: http://code.openbravo.com/erp/devel/pi/rev/b975d72dec38be6c7a9ca8444a98db8924647c1a [^] Fixed 24556. Disallow referencing external entities in /ws/dal/ Reconfigure the xml-parser used behind /ws/dal to not accept external entity references as the xml data is coming from outside Openbravo. --- M src/org/openbravo/service/rest/DalWebService.java --- |
|
(0060724) AugustoMauch (manager) 2013-08-22 08:17 |
Code reviewed and verified in pi@381dd8af30f9 |
|
(0060734) hudsonbot (developer) 2013-08-22 18:17 |
A changeset related to this issue has been promoted main and to the Central Repository, after passing a series of tests. Promotion changeset: https://code.openbravo.com/erp/devel/main/rev/7535642cd9cf [^] Maturity status: Test |
|
Notes |
|
Issue History |
|||
| Date Modified | Username | Field | Change |
| 2013-08-21 17:46 | shuehner | New Issue | |
| 2013-08-21 17:46 | shuehner | Assigned To | => shuehner |
| 2013-08-21 17:46 | shuehner | Modules | => Core |
| 2013-08-21 17:46 | shuehner | Triggers an Emergency Pack | => No |
| 2013-08-21 17:48 | shuehner | Status | new => scheduled |
| 2013-08-21 17:48 | shuehner | fix_in_branch | => pi |
| 2013-08-21 18:11 | hgbot | Checkin | |
| 2013-08-21 18:11 | hgbot | Note Added: 0060714 | |
| 2013-08-21 18:11 | hgbot | Status | scheduled => resolved |
| 2013-08-21 18:11 | hgbot | Resolution | open => fixed |
| 2013-08-21 18:11 | hgbot | Fixed in SCM revision | => http://code.openbravo.com/erp/devel/pi/rev/b975d72dec38be6c7a9ca8444a98db8924647c1a [^] |
| 2013-08-21 18:14 | shuehner | Review Assigned To | => AugustoMauch |
| 2013-08-21 18:14 | shuehner | fix_in_branch | pi => |
| 2013-08-22 08:17 | AugustoMauch | Note Added: 0060724 | |
| 2013-08-22 08:17 | AugustoMauch | Status | resolved => closed |
| 2013-08-22 08:17 | AugustoMauch | Fixed in Version | => 3.0MP27 |
| 2013-08-22 18:17 | hudsonbot | Checkin | |
| 2013-08-22 18:17 | hudsonbot | Note Added: 0060734 | |
| 2019-04-18 13:35 | alostale | Relationship added | related to 0040642 |
|
Issue History |
| Copyright © 2000 - 2009 MantisBT Group |
 |